Distributed storage network for modification of a data object

ABSTRACT

A distributed storage network generates a plurality of data segments from a data object and stores each of the plurality of data segments as a plurality of encoded data slices generated from an error encoding dispersal function. When the distributed storage network receives a modification request for the data object, it determines a size of the plurality of data segments of the data object from a segment size field and identifies one of the plurality of data segments requiring modification. The identified data segment is reconstructed from the plurality of encoded data slices and modified in accordance with the modification request.

CROSS-REFERENCE TO RELATED PATENTS

The present U.S. Utility Patent Application claims priority pursuant to35 U.S.C. §120, as a continuation, to the following U.S. Utility PatentApplication which is hereby incorporated herein by reference in itsentirety and made part of the present U.S. Utility Patent Applicationfor all purposes:

1. U.S. Utility patent application Ser. No. 13/932,320, entitled“DISTRIBUTED STORAGE NETWORK FOR MODIFICATION OF A DATA OBJECT,” filedJul. 1, 2013, pending, which claims priority pursuant to 35 U.S.C. §120,as a continuation, to the following U.S. Utility Patent Applicationwhich is hereby incorporated herein by reference in its entirety andmade part of the present U.S. Utility Patent Application for allpurposes:

2. U.S. Utility patent application Ser. No. 12/839,197, entitled“DISTRIBUTED STORAGE NETWORK FOR MODIFICATION OF A DATA OBJECT,” filedJul. 19, 2010, now issued as U.S. Pat. No. 8,479,078 on Jul. 2, 2013,which claims priority pursuant to 35 U.S.C. §119(e) to the followingU.S. Provisional Patent Application which is hereby incorporated hereinby reference in its entirety and made part of the present U.S. UtilityPatent Application for all purposes:

-   -   a. U.S. Provisional Application Ser. No. 61/256,436 entitled        “DISTRIBUTED STORAGE NETWORK ACCESS,” filed Oct. 30, 2009, now        expired.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

Not applicable.

INCORPORATION-BY-REFERENCE OF MATERIAL SUBMITTED ON A COMPACT DISC

Not applicable.

BACKGROUND OF THE INVENTION

1. Technical Field of the Invention

This invention relates generally to computing systems and moreparticularly to data storage within such computing systems.

2. Description of Related Art

This invention relates generally to computing systems and moreparticularly to data storage solutions within such computing systems.

Description of Related Art

Computers are known to communicate, process, and store data. Suchcomputers range from wireless smart phones to data centers that supportmillions of web searches, stock trades, or on-line purchases every day.In general, a computing system generates data and/or manipulates datafrom one form into another. For instance, an image sensor of thecomputing system generates raw picture data and using an imagecompression program (e.g., JPEG, MPEG, etc.), the computing systemmanipulates the raw picture data into a standardized compressed image.

With continued advances in processing speed and communication speed,computers are capable of processing real time multimedia data forapplications ranging from simple voice communications to streaming highdefinition video. As such, general-purpose information appliances arereplacing purpose-built communications devices (e.g., a telephone). Forexample, smart phones can support telephony communications but they arealso capable of text messaging and accessing the internet to performfunctions including email, web browsing, remote applications access, andmedia communications (e.g., telephony voice, image transfer, musicfiles, video files, real time video streaming, etc.).

Each type of computer is constructed and operates in accordance with oneor more communication, processing, and storage standards. As a result ofstandardization and with advances in technology, more and moreinformation content is being converted into digital formats. Forexample, more digital cameras are now being sold than film cameras, thusproducing more digital pictures. As another example, web-basedprogramming is becoming an alternative to over the air televisionbroadcasts and/or cable broadcasts. As further examples, papers, books,video entertainment, home video, etc. are now being stored digitally.This increased storage of information content increases the demand onthe storage function of computers.

A typical computer storage system includes one or more memory devicesaligned with the needs of the various operational aspects of thecomputer's processing and communication functions. Generally, theimmediacy of access dictates what type of memory device is used. Forexample, random access memory (RAM) memory can be accessed in any randomorder with a constant response time, thus it is typically used for cachememory and main memory. By contrast, memory device technologies thatrequire physical movement such as magnetic disks, tapes, and opticaldiscs, have a variable response time as the physical movement can takelonger than the data transfer, thus they are typically used forsecondary memory (e.g., hard drive, backup memory, etc.).

A computer's storage system will be compliant with one or more computerstorage standards that include, but are not limited to, network filesystem (NFS), flash file system (FFS), disk file system (DFS), smallcomputer system interface (SCSI), internet small computer systeminterface (iSCSI), file transfer protocol (FTP), and web-baseddistributed authoring and versioning (WebDAV). These standards specifythe data storage format (e.g., files, data objects, data blocks,directories, etc.) and interfacing between the computer's processingfunction and its storage system, which is a primary function of thecomputer's memory controller.

Despite the standardization of the computer and its storage system,memory devices fail; especially commercial grade memory devices thatutilize technologies incorporating physical movement (e.g., a discdrive). For example, it is fairly common for a disc drive to routinelysuffer from bit level corruption and to completely fail after threeyears of use. One solution is to a higher-grade disc drive, which addssignificant cost to a computer.

Another solution is to utilize multiple levels of redundant disc drivesto replicate the data into two or more copies. One such redundant driveapproach is called redundant array of independent discs (RAID). In aRAID device, a RAID controller adds parity data to the original databefore storing it across the array. The parity data is calculated fromthe original data such that the failure of a disc will not result in theloss of the original data. For example, RAID 5 uses three discs toprotect data from the failure of a single disc. The parity data, andassociated redundancy overhead data, reduces the storage capacity ofthree independent discs by one third (e.g., n−1=capacity). RAID 6 canrecover from a loss of two discs and requires a minimum of four discswith a storage capacity of n−2.

While RAID addresses the memory device failure issue, it is not withoutits own failures issues that affect its effectiveness, efficiency andsecurity. For instance, as more discs are added to the array, theprobability of a disc failure increases, which increases the demand formaintenance. For example, when a disc fails, it needs to be manuallyreplaced before another disc fails and the data stored in the RAIDdevice is lost. To reduce the risk of data loss, data on a RAID deviceis typically copied on to one or more other RAID devices. While thisaddresses the loss of data issue, it raises a security issue sincemultiple copies of data are available, which increases the chances ofunauthorized access. Further, as the amount of data being stored grows,the overhead of RAID devices becomes a non-trivial efficiency issue.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S)

FIG. 1 is a schematic block diagram of an embodiment of a computingsystem in accordance with the invention;

FIG. 2 is a schematic block diagram of an embodiment of a computing corein accordance with the invention;

FIG. 3 is a schematic block diagram of an embodiment of a distributedstorage processing unit in accordance with the invention;

FIG. 4 is a schematic block diagram of an embodiment of a grid module inaccordance with the invention;

FIG. 5 is a diagram of an example embodiment of error coded data slicecreation in accordance with the invention;

FIG. 6 is a schematic block diagram of an embodiment of a file systemhierarchy in accordance with the invention;

FIG. 7 is a schematic block diagram of an embodiment of a segment andslice directory in accordance with the invention;

FIG. 8 is a logic flow diagram of an embodiment of a method formodifying a data object in accordance with the invention;

FIG. 9 is a logic flow diagram of an embodiment of a method foridentifying a data segment of a data object for modification inaccordance with the invention;

FIG. 10 is a schematic block diagram of an embodiment of a modificationrequest in accordance with the invention;

FIG. 11 is a logic flow diagram of another embodiment of a method formodifying a data object in accordance with the invention;

FIG. 12 is a logic flow diagram of another embodiment of a method formodifying a data object in accordance with the invention;

FIG. 13 is a schematic block diagram of an embodiment of a write requestin accordance with the invention;

FIG. 14 is a logic flow diagram of an embodiment of a method forgenerating and storing rebuilt encoded data slices from a modified datasegment in accordance with the invention;

FIG. 15 is a schematic block diagram of an embodiment of a data segmentheader in accordance with the invention;

FIG. 16 is a logic flow diagram of another embodiment of a method formodifying a data object in accordance with the invention;

FIG. 17 is a logic flow diagram of an embodiment of a method forupdating a system element in accordance with the invention; and

FIG. 18 is a logic flow diagram of another embodiment of a method forupdating a system element in accordance with the invention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 is a schematic block diagram of a computing system 10 thatincludes one or more of a first type of user devices 12, one or more ofa second type of user devices 14, at least one distributed storage (DS)processing unit 16, at least one DS managing unit 18, at least onestorage integrity processing unit 20, and a distributed storage network(DSN) memory 22 coupled via a network 24. The network 24 may include oneor more wireless and/or wire lined communication systems; one or moreprivate intranet systems and/or public internet systems; and/or one ormore local area networks (LAN) and/or wide area networks (WAN).

The DSN memory 22 includes a plurality of distributed storage (DS) units36 for storing data of the system. Each of the DS units 36 includes aprocessing module and memory and may be located at a geographicallydifferent site than the other DS units (e.g., one in Chicago, one inMilwaukee, etc.). The processing module may be a single processingdevice or a plurality of processing devices. Such a processing devicemay be a microprocessor, micro-controller, digital signal processor,microcomputer, central processing unit, field programmable gate array,programmable logic device, state machine, logic circuitry, analogcircuitry, digital circuitry, and/or any device that manipulates signals(analog and/or digital) based on hard coding of the circuitry and/oroperational instructions. The processing module may have an associatedmemory and/or memory element, which may be a single memory device, aplurality of memory devices, and/or embedded circuitry of the processingmodule. Such a memory device may be a read-only memory, random accessmemory, volatile memory, non-volatile memory, static memory, dynamicmemory, flash memory, cache memory, and/or any device that storesdigital information. Note that if the processing module includes morethan one processing device, the processing devices may be centrallylocated (e.g., directly coupled together via a wired and/or wireless busstructure) or may be distributedly located (e.g., cloud computing viaindirect coupling via a local area network and/or a wide area network).Further note that when the processing module implements one or more ofits functions via a state machine, analog circuitry, digital circuitry,and/or logic circuitry, the memory and/or memory element storing thecorresponding operational instructions may be embedded within, orexternal to, the circuitry comprising the state machine, analogcircuitry, digital circuitry, and/or logic circuitry. Still further notethat, the memory element stores, and the processing module executes,hard coded and/or operational instructions corresponding to at leastsome of the steps and/or functions illustrated in FIGS. 1-18.

Each of the user devices 12-14, the DS processing unit 16, the DSmanaging unit 18, and the storage integrity processing unit 20 may be aportable computing device (e.g., a social networking device, a gamingdevice, a cell phone, a smart phone, a personal digital assistant, adigital music player, a digital video player, a laptop computer, ahandheld computer, a video game controller, and/or any other portabledevice that includes a computing core) and/or a fixed computing device(e.g., a personal computer, a computer server, a cable set-top box, asatellite receiver, a television set, a printer, a fax machine, homeentertainment equipment, a video game console, and/or any type of homeor office computing equipment). Such a portable or fixed computingdevice includes a computing core 26 and one or more interfaces 30, 32,and/or 38. An embodiment of the computing core 26 will be described withreference to FIG. 2.

With respect to the interfaces, each of the interfaces 30, 32, and 38includes software and/or hardware to support one or more communicationlinks via the network 24 and/or directly. For example, interfaces 30support a communication link (wired, wireless, direct, via a LAN, viathe network 24, etc.) between the first type of user device 14 and theDS processing unit 16. As another example, DSN interface 32 supports aplurality of communication links via the network 24 between the DSNmemory 22 and the DS processing unit 16, the first type of user device12, and/or the storage integrity processing unit 20. As yet anotherexample, interface 38 supports a communication link between the DSmanaging unit 18 and any one of the other devices and/or units 12, 14,16, 20, and/or 22 via the network 24.

In general and with respect to data storage, the system 10 supportsthree primary functions: distributed network data storage management,distributed data storage and retrieval, and data storage integrityverification. In accordance with these three primary functions, data canbe distributedly stored in a plurality of physically different locationsand subsequently retrieved in a reliable and secure manner regardless offailures of individual storage devices, failures of network equipment,the duration of storage, the amount of data being stored, attempts athacking the data, etc.

The DS managing unit 18 performs distributed network data storagemanagement functions, which include establishing distributed datastorage parameters, performing network operations, performing networkadministration, and/or performing network maintenance. The DS managingunit 18 establishes the distributed data storage parameters (e.g.,allocation of virtual DSN memory space, distributed storage parameters,security parameters, billing information, user profile information,etc.) for one or more of the user devices 12-14 (e.g., established forindividual devices, established for a user group of devices, establishedfor public access by the user devices, etc.). For example, the DSmanaging unit 18 coordinates the creation of a vault (e.g., a virtualmemory block) within the DSN memory 22 for a user device (for a group ofdevices, or for public access). The DS managing unit 18 also determinesthe distributed data storage parameters for the vault. In particular,the DS managing unit 18 determines a number of slices (e.g., the numberthat a data segment of a data file and/or data block is partitioned intofor distributed storage) and a read threshold value (e.g., the minimumnumber of slices required to reconstruct the data segment).

As another example, the DS managing module 18 creates and stores,locally or within the DSN memory 22, user profile information. The userprofile information includes one or more of authentication information,permissions, and/or the security parameters. The security parameters mayinclude one or more of encryption/decryption scheme, one or moreencryption keys, key generation scheme, and data encoding/decodingscheme.

As yet another example, the DS managing unit 18 creates billinginformation for a particular user, user group, vault access, publicvault access, etc. For instance, the DS managing unit 18 tracks thenumber of times user accesses a private vault and/or public vaults,which can be used to generate a per-access bill. In another instance,the DS managing unit 18 tracks the amount of data stored and/orretrieved by a user device and/or a user group, which can be used togenerate a per-data-amount bill.

The DS managing unit 18 also performs network operations, networkadministration, and/or network maintenance. As at least part ofperforming the network operations and/or administration, the DS managingunit 18 monitors performance of the devices and/or units of the system10 for potential failures, determines the devices and/or unit'sactivation status, determines the devices' and/or units' loading, andany other system level operation that affects the performance level ofthe system 10. For example, the DS managing unit 18 receives andaggregates network management alarms, alerts, errors, statusinformation, performance information, and messages from the devices12-14 and/or the units 16, 20, 22. For example, the DS managing unit 18receives a simple network management protocol (SNMP) message regardingthe status of the DS processing unit 16.

The DS managing unit 18 performs the network maintenance by identifyingequipment within the system 10 that needs replacing, upgrading,repairing, and/or expanding. For example, the DS managing unit 18determines that the DSN memory 22 needs more DS units 36 or that one ormore of the DS units 36 needs updating.

The second primary function (i.e., distributed data storage andretrieval) begins and ends with a user device 12-14. For instance, if asecond type of user device 14 has a data object 40, such as a data fileand/or data block, to store in the DSN memory 22, it sends the dataobject 40 to the DS processing unit 16 via its interface 30. As will bedescribed in greater detail with reference to FIG. 2, the interface 30functions to mimic a conventional operating system (OS) file systeminterface (e.g., network file system (NFS), flash file system (FFS),disk file system (DFS), file transfer protocol (FTP), web-baseddistributed authoring and versioning (WebDAV), etc.) and/or a blockmemory interface (e.g., small computer system interface (SCSI), internetsmall computer system interface (iSCSI), etc.). In addition, theinterface 30 may attach a user identification code (ID) to the dataobject 40.

The DS processing unit 16 receives the data object 40 via its interface30 and performs a distributed storage (DS) process 34 thereon (e.g., anerror coding dispersal storage function). The DS processing 34 begins bypartitioning the data object 40 into one or more data segments, which isrepresented as Y data segments. The DS processing 34 may partition thedata object 40 into fixed byte size segments (e.g., 21 to 2n bytes,where n=>2) or variable byte size segments (e.g., change byte size fromsegment to segment, or from groups of segments to groups of segments,etc.).

For example, in FIG. 1 for each of the Y number of data segments 42 a-n,the DS processing 34 error encodes (e.g., forward error correction(FEC), information dispersal algorithm, or error correction coding) andslices (or slices then error encodes) the data segments 42 a-n into aplurality of error coded (EC) data slices 42 a-42 n and 46 a-46 n, whichare represented as X slices per data segment. The number of slices (X)per segment, which corresponds to a number of pillars n, is set inaccordance with the distributed data storage parameters and the errorcoding scheme. For example, if a Reed-Solomon (or other FEC scheme) isused in an X/T system, then a data segment is divided into X number ofslices, where T number of slices are needed to reconstruct the originaldata (i.e., T is the threshold). As a few specific examples, the X/Tfactor may be 5/3; 6/4; 8/6; 8/5; 16/10.

For each slice 44 a-n and 46 a-n, the DS processing unit 16 creates aunique slice name and appends it to the corresponding slice. The slicename includes universal DSN memory addressing routing information (e.g.,virtual memory addresses in the DSN memory 22) and user-specificinformation (e.g., user ID, file name, data block identifier, etc.).

The DS processing unit 16 transmits the plurality of EC slices 44 a-nand 46 a-n to a plurality of DS units 36 of the DSN memory 22 via theDSN interface 32 and the network 24. The DSN interface 32 formats eachof the slices for transmission via the network 24. For example, the DSNinterface 32 may utilize an internet protocol (e.g., TCP/IP, etc.) topacketize the slices 44 a-n and 46 a-n for transmission via the network24.

The number of DS units 36 receiving the slices 44 a-n and 46 a-n isdependent on the distributed data storage parameters established by theDS managing unit 18. For example, the DS managing unit 18 may indicatethat each slice is to be stored in a different DS unit 36. As anotherexample, the DS managing unit 18 may indicate that like slice numbers ofdifferent data segments are to be stored in the same DS unit 36. Forexample, the first slice 44 a and 46 a of each of the data segments 42a-n is to be stored in a first DS unit 36, the second slice 44 b and 46b of each of the data segments 42 a-n is to be stored in a second DSunit 36, etc. In this manner, the data is encoded and distributedlystored at physically diverse locations to improved data storageintegrity and security. Further examples of encoding the data segmentswill be provided with reference to one or more of FIGS. 2-18.

Each DS unit 36 that receives a slice for storage translates the virtualDSN memory address of the slice into a local physical address forstorage. Accordingly, each DS unit 36 maintains a virtual to physicalmemory mapping to assist in the storage and retrieval of data.

The first type of user device 12 performs a similar function to storedata in the DSN memory 22 with the exception that it includes the DSprocessing. As such, the device 12 encodes and slices the data fileand/or data block it has to store. The device then transmits the slices11 to the DSN memory via its DSN interface 32 and the network 24.

For a second type of user device 14 to retrieve a data file or datablock from memory, it issues a read command via its interface 30 to theDS processing unit 16. The DS processing unit 16 performs the DSprocessing 34 to identify the DS units 36 storing the slices of the datafile and/or data block based on the read command. The DS processing unit16 may also communicate with the DS managing unit 18 to verify that theuser device 14 is authorized to access the requested data.

Assuming that the user device is authorized to access the requesteddata, the DS processing unit 16 issues slice read commands to at least athreshold number of the DS units 36 storing the requested data (e.g., toat least 10 DS units for a 16/10 error coding scheme). Each of the DSunits 36 receiving the slice read command, verifies the command,accesses its virtual to physical memory mapping, retrieves the requestedslice, or slices, and transmits it to the DS processing unit 16.

Once the DS processing unit 16 has received a read threshold number ofslices for a data segment, it performs an error decoding function andde-slicing to reconstruct the data segment. When Y number of datasegments has been reconstructed, the DS processing unit 16 provides dataobject 40 to the user device 14. Note that the first type of user device12 performs a similar process to retrieve data object 40.

The storage integrity processing unit 20 performs the third primaryfunction of data storage integrity verification. In general, the storageintegrity processing unit 20 periodically retrieves slices 48, and/orslice names, of a data object 40 to verify that one or more slices havenot been corrupted or lost (e.g., the DS unit failed). The retrievalprocess mimics the read process previously described.

If the storage integrity processing unit 20 determines that one or moreslices 48 is corrupted or lost, it rebuilds the corrupted or lostslice(s) in accordance with the error coding scheme. The storageintegrity processing unit 20 stores the rebuilt slice, or slices, in theappropriate DS unit(s) 36 in a manner that mimics the write processpreviously described.

FIG. 2 is a schematic block diagram of an embodiment of a computing core26 that includes a processing module 50, a memory controller 52, mainmemory 54, a video graphics processing unit 55, an input/output (IO)controller 56, a peripheral component interconnect (PCI) interface 58,at least one IO interface 60, IO device interface module 62, a read onlymemory (ROM) basic input output system (BIOS) 64, and one or more memoryinterface modules. The memory interface module(s) includes one or moreof a universal serial bus (USB) interface module 66, a host bus adapter(HBA) interface module 68, a network interface module 70, a flashinterface module 72, a hard drive interface module 74, and a DSNinterface module 76. Note the DSN interface module 76 and/or the networkinterface module 70 may function as the interface 30 of the user device14 of FIG. 1. Further note that the IO device interface module 62 and/orthe memory interface modules may be collectively or individuallyreferred to as IO ports.

The processing module 50 may be a single processing device or aplurality of processing devices. Such a processing device may be amicroprocessor, micro-controller, digital signal processor,microcomputer, central processing unit, field programmable gate array,programmable logic device, state machine, logic circuitry, analogcircuitry, digital circuitry, and/or any device that manipulates signals(analog and/or digital) based on hard coding of the circuitry and/oroperational instructions. The processing module 50 may have anassociated memory and/or memory element, which may be a single memorydevice, a plurality of memory devices, and/or embedded circuitry of theprocessing module 50. Such a memory device may be a read-only memory,random access memory, volatile memory, non-volatile memory, staticmemory, dynamic memory, flash memory, cache memory, and/or any devicethat stores digital information. Note that if the processing module 50includes more than one processing device, the processing devices may becentrally located (e.g., directly coupled together via a wired and/orwireless bus structure) or may be distributedly located (e.g., cloudcomputing via indirect coupling via a local area network and/or a widearea network). Further note that when the processing module 50implements one or more of its functions via a state machine, analogcircuitry, digital circuitry, and/or logic circuitry, the memory and/ormemory element storing the corresponding operational instructions may beembedded within, or external to, the circuitry comprising the statemachine, analog circuitry, digital circuitry, and/or logic circuitry.Still further note that, the memory element stores, and the processingmodule 50 executes, hard coded and/or operational instructionscorresponding to at least some of the steps and/or functions illustratedin FIGS. 1-18.

FIG. 3 is a schematic block diagram of an embodiment of a dispersedstorage (DS) processing module 34 of user device 12 and/or of the DSprocessing unit 16. The DS processing module 34 includes a gatewaymodule 78, an access module 80, a grid module 82, and a storage module84. The DS processing module 34 may also include an interface 30 and DSNinterface 32 or the interfaces 30 and/or 32 may be part of user 12 or ofthe DS processing unit 14. The DS processing module 34 may furtherinclude a bypass/feedback path between the storage module 84 to thegateway module 78. Note that the modules 78-84 of the DS processingmodule 34 may be in a single unit or distributed across multiple units.

In an example of storing data, the gateway module 78 receives anincoming request with a data object 40. The incoming request may alsoinclude a user ID field 86, an object name field 88 and othercorresponding information such as a process identifier (e.g., aninternal process/application ID), metadata, a file system directory, ablock number, a transaction message, a user device identity (ID), a dataobject identifier, a source name, and/or user information. The gatewaymodule 78 authenticates the user associated with the data object byverifying the user ID 86 with the managing unit 18 and/or anotherauthenticating unit.

When the user is authenticated, the gateway module 78 obtains userinformation from the management unit 18, the user device 12-Source 14,and/or the other authenticating unit. The user information includes avault identifier, operational parameters, and user attributes (e.g.,user data, billing information, etc.). A vault identifier identifies avault, which is a virtual memory space that maps to a set of DS storageunits 36. For example, vault 1 (i.e., user 1's DSN memory space)includes eight DS storage units (X=8 wide) and vault 2 (i.e., user 2'sDSN memory space) includes sixteen DS storage units (X=16 wide). Theoperational parameters may include an error coding algorithm, the widthn (number of pillars X or slices per segment for this vault), a readthreshold T, a write threshold, an encryption algorithm, a slicingparameter, a compression algorithm, an integrity check method, cachingsettings, parallelism settings, and/or other parameters that may be usedto access the DSN memory layer.

The gateway module 78 uses the user information to assign a source name35 to the data object 40. For instance, the gateway module 60 determinesthe source name 35 of the data object 40 based on the vault identifierand the data object 40. For example, the source name may contain a fileidentifier (ID), a vault generation number, a reserved field, and avault identifier (ID). As another example, the gateway module 78 maygenerate the file ID based on a hash function of the data object 40.Note that the gateway module 78 may also perform message conversion,protocol conversion, electrical conversion, optical conversion, accesscontrol, user identification, user information retrieval, trafficmonitoring, statistics generation, configuration, management, and/orsource name determination.

The access module 80 receives the data object 40 and creates a pluralityof data segments 1 through Y 42 a-n in accordance with a data storageprotocol (e.g., file storage system, a block storage system, and/or anaggregated block storage system). The number Y of data segments may befixed with a segment size depending on the data object size or thenumber of segments may vary with a fixed segment size. For example, whenthe number Y of segments is chosen to be a fixed number, then the sizeof the segments varies as a function of the size of the data object. Forinstance, if the data object is an image file of 4,194,304 eight bitbytes (e.g., 33,554,432 bits) and the number of segments Y=131,072, theneach segment is 256 bits or 32 bytes. As another example, when thesegment size is fixed, then the number of segments Y varies based on thesize of data object. For instance, if the data object is an image fileof 4,194,304 bytes and the fixed segment size of each segment is 4,096bytes, then the number of segments Y=1,024. Note that each segment isassociated with the same source name 35.

The grid module 82 receives the Y data segments and may manipulate(e.g., compression, encryption, cyclic redundancy check (CRC), etc.)each of the data segments before performing an error coding function ofthe error coding dispersal storage function to produce a pre-manipulateddata segment. After manipulating a data segment, if applicable, the gridmodule 82 error encodes (e.g., Reed-Solomon, Convolution encoding,Trellis encoding, etc.) the data segment or manipulated data segmentinto X error coded data slices 42-44.

The value X, or the number of pillars (e.g., X=16), is chosen as aparameter of the error coding dispersal storage function. Otherparameters of the error coding dispersal function include a readthreshold T, a write threshold W, etc. The read threshold (e.g., T=10,when X=16) corresponds to the minimum number of error coded data slicesrequired to reconstruct the data segment. In other words, the DSprocessing module 34 can compensate for X−T (e.g., 16−10=6) missingerror coded data slices per data segment. The write threshold Wcorresponds to a minimum number of DS storage units that acknowledgeproper storage of their respective data slices before the DS processingmodule indicates proper storage of the encoded data segment. Note thatthe write threshold W is greater than or equal to the read threshold T(i.e., W≧T) for a given number of pillars (X).

For each data slice of a data segment, the grid module 82 generates aunique slice name 37 and attaches it thereto. The slice name 37 includesa universal routing information field and a vault specific field and maybe 48 bytes (e.g., 24 bytes for each of the universal routinginformation field and the vault specific field). As illustrated, theuniversal routing information field includes a slice index, a vault ID,a vault generation, and a reserved field. The slice index is based onthe pillar number n and the vault ID and, as such, is unique for eachpillar (e.g., slices of the same pillar for the same vault for anysegment will share the same slice index). The vault specific fieldincludes a data name, which includes a file ID and a segment number(e.g., a sequential numbering of data segments 1-Y of a simple dataobject or a data block number).

Prior to outputting the error coded data slices of a data segment, thegrid module may perform post-slice manipulation on the slices. Ifenabled, the manipulation includes slice level compression, encryption,CRC, addressing, tagging, and/or other manipulation to improve theeffectiveness of the computing system.

When the error coded (EC) data slices of a data segment are ready forstorage, the grid module 82 determines which of the DS storage units 36will store the EC data slices based on a dispersed storage memorymapping associated with the user's vault and/or DS storage unit 36attributes. The DS storage unit attributes may include availability,self-selection, performance history, link speed, link latency,ownership, available DSN memory, domain, cost, a prioritization scheme,a centralized selection message from another source, a lookup table,data ownership, and/or any other factor to optimize the operation of thecomputing system. Note that the number of DS storage units 36 in anembodiment is equal to or greater than the number of pillars (e.g., X)so that no more than one error coded data slice of the same data segmentis stored on the same DS storage unit 36. Further note that EC dataslices of the same pillar number but of different segments (e.g., ECdata slice 1 of data segment 1 and EC data slice 1 of data segment 2)may be stored on the same or different DS storage units 36.

The storage module 84 performs an integrity check on the outboundencoded data slices and, when successful, identifies a plurality of DSstorage units based on information provided by the grid module. Thestorage module then outputs the encoded data slices 1 through X of eachsegment 1 through Y to the DS storage units. Each of the DS storageunits 36 stores its EC data slice(s) and maintains a local virtual DSNaddress to physical location table to convert the virtual DSN address ofthe EC data slice(s) into physical storage addresses.

In an example of a read operation, the user device 12 and/or 14 sends aread request to the DS processing 34, which authenticates the request.When the request is authentic, the DS processing 34 sends a read messageto each of the DS storage units 36 storing slices of the data objectbeing read. The slices are received via the DSN interface 32 andprocessed by the storage module 84, which performs a parity check andprovides the slices to the grid module 82 when the parity check issuccessful. The grid module 82 decodes the slices in accordance with theerror coding dispersal storage function to reconstruct the data segment.The access module 80 reconstructs the data object from the data segmentsand the gateway module 78 formats the data object for transmission tothe user device.

FIG. 4 is a schematic block diagram of an embodiment of a grid module 82that includes a control unit 73, a pre-slice manipulator 75, an encoder77, a slicer 79, a post-slice manipulator 81, a pre-slice de-manipulator83, a decoder 85, a de-slicer 87, and/or a post-slice de-manipulator 89.Note that the control unit 73 may be partially or completely external tothe grid module 82. For example, the control unit 73 may be part of thecomputing core at a remote location, part of a user device, part of theDS managing unit 18, or distributed amongst one or more DS storageunits.

In an example of write operation, the pre-slice manipulator 75 receivesa data segment 42 a-n and a write instruction from an authorized userdevice. The pre-slice manipulator 75 determines if pre-manipulation ofthe data segment 42 a-n is required and, if so, what type. The pre-slicemanipulator 75 may make the determination independently or based oninstructions from the control unit 73, where the determination is basedon a computing system-wide predetermination, a table lookup, vaultparameters associated with the user identification, the type of data,security requirements, available DSN memory, performance requirements,and/or other metadata.

Once a positive determination is made, the pre-slice manipulator 75manipulates the data segment 42 a-n in accordance with the type ofmanipulation. For example, the type of manipulation may be compression(e.g., Lempel-Ziv-Welch, Huffman, Golomb, fractal, wavelet, etc.),signatures (e.g., Digital Signature Algorithm (DSA), Elliptic Curve DSA,Secure Hash Algorithm, etc.), watermarking, tagging, encryption (e.g.,Data Encryption Standard, Advanced Encryption Standard, etc.), addingmetadata (e.g., time/date stamping, user information, file type, etc.),cyclic redundancy check (e.g., CRC32), and/or other data manipulationsto produce the pre-manipulated data segment.

The encoder 77 encodes the pre-manipulated data segment 42 using aforward error correction (FEC) encoder (and/or other type of erasurecoding and/or error coding) to produce an encoded data segment 94. Theencoder 77 determines which forward error correction algorithm to usebased on a predetermination associated with the user's vault, a timebased algorithm, user direction, DS managing unit direction, controlunit direction, as a function of the data type, as a function of thedata segment 42 metadata, and/or any other factor to determine algorithmtype. The forward error correction algorithm may be Golay,Multidimensional parity, Reed-Solomon, Hamming, Bose Ray ChauduriHocquenghem (BCH), Cauchy-Reed-Solomon, or any other FEC encoder. Notethat the encoder 77 may use a different encoding algorithm for each datasegment 42, the same encoding algorithm for the data segments 42 of adata object, or a combination thereof.

The encoded data segment 94 is of greater size than the data segment 42by the overhead rate of the encoding algorithm by a factor of X/T, whereX is the width or number of slices, and T is the read threshold. In thisregard, the corresponding decoding process can accommodate at most X-Tmissing EC data slices and still recreate the data segment 42. Forexample, if X=16 and T=10, then the data segment 42 will be recoverableas long as 10 or more EC data slices per data segment are not corrupted.

The slicer 79 transforms the encoded data segment 94 into EC data slicesin accordance with the slicing parameter from the vault for this userand/or data segment 42. For example, if the slicing parameter is X=16,then the slicer slices each encoded data segment 94 into 16 encodedslices.

The post-slice manipulator 81 performs, if enabled, post-manipulation onthe encoded slices to produce the EC data slices. If enabled, thepost-slice manipulator 81 determines the type of post-manipulation,which may be based on a computing system-wide predetermination,parameters in the vault for this user, a table lookup, the useridentification, the type of data, security requirements, available DSNmemory, performance requirements, control unit directed, and/or othermetadata. Note that the type of post-slice manipulation may includeslice level compression, signatures, encryption, CRC, addressing,watermarking, tagging, adding metadata, and/or other manipulation toimprove the effectiveness of the computing system.

In an example of a read operation, the post-slice de-manipulator 89receives at least a read threshold number of EC data slices and performsthe inverse function of the post-slice manipulator 81 to produce aplurality of encoded slices. The de-slicer 87 de-slices the encodedslices to produce an encoded data segment 94. The decoder 85 performsthe inverse function of the encoder 77 to recapture the data segment 42.The pre-slice de-manipulator 83 performs the inverse function of thepre-slice manipulator 75 to recapture the data segment.

FIG. 5 is a diagram of an example of slicing an encoded data segment 94by the slicer 79. In this example, the encoded data segment includesthirty-two bits, but may include more or less bits. The slicer 79disperses the bits of the encoded data segment 94 across the EC dataslices in a pattern as shown. As such, each EC data slice does notinclude consecutive bits of the data segment 94 reducing the impact ofconsecutive bit failures on data recovery. For example, if EC data slice2 (which includes bits 1, 5, 9, 13, 17, 25, and 29) is unavailable(e.g., lost, inaccessible, or corrupted), the data segment can bereconstructed from the other EC data slices (e.g., 1, 3 and 4 for a readthreshold of 3 and a width of 4).

FIG. 6 is a schematic block diagram of an embodiment of a file systemhierarchy including a plurality of user virtual memories in a virtualDSN address space 148, a virtual dispersed storage network (DSN) addressto physical location table 142, and a physical dispersed storage network(DSN) memory 22. The file system hierarchy is an illustration oftranslating a user virtual memory address space 152 into a virtualdispersed storage network (DSN) address space 148 and then to a physicaladdress in a DSN memory 22. In this illustration, the physical DSNmemory 22 includes a plurality of DS storage units 36 (e.g., A, C, D,and F). In an example, where there are four pillars, there are fourslices (X=4) created for each of Y data segments. Pillars can beallocated to more than one DS storage unit, but a given DS storage unitis not generally assigned to store more than one pillar from a givenfile/data object of a user vault to improve system robustness (e.g.,avoiding loss of multiple slices of a data segment as a result of asingle DS storage unit failure).

In an embodiment, one of the plurality of user virtual memories 152 a-nutilizes a native OS file system to access the virtual DSN address space148 by including source name information in requests such as read,write, modify, delete, list, etc. A vault identifier in the source nameand/or a file/block name may be used to index the virtual DSN addressspace 148 to determine a user vault. A unique virtual vault isassociated with each user (e.g., an individual, a group of individuals,a business entity, a group of business entities, etc.) and may containoperational parameters (described with more detail with respect to FIG.7), user attributes (e.g., user identification, billing data, etc.) anda list of DSN memories 22 and a plurality of storage units 36 for a DSNmemory 22 that may be utilized to support the user.

In an example, the total virtual DSN address space 148 is defined by aforty-eight byte identifier thus creating 25648 possible slice names.The virtual DSN address space 148 accommodates addressing of EC dataslices corresponding to segments of data objects (e.g., data file,blocks, streams) over various generations and vaults. The slice name isa virtual DSN address and remains the same even as different DS memories22 or DS storage units 36 are added or deleted from the physical DSNmemory 22.

A user has a range of virtual DSN addresses assigned to their vault,user virtual memory 152 a-n. For instance, the virtual DSN addressestypically do not change over the operational lifespan of the system forthe user. In another instance, the virtual DSN address space 148 isdynamically altered from time to time to provide such benefits asimproved security and expansion, retraction, and/or capability. Avirtual DSN address space 148 security algorithm may alter the virtualDSN address space 148 according to one or more of a command (e.g., fromthe DS managing unit 18), a schedule, a detected security breach, or anyother trigger. The virtual DSN address may also be encrypted in use thusrequiring encryption and decryption steps whenever the virtual DSNaddress is used.

The vault and file name index used to access the virtual DSN addressspace 148 and to create the slice names (virtual DSN addresses) may alsobe used as an index to access the virtual DSN address to physicallocation table 142. For example, the virtual DSN address to physicallocation table 142 is sorted by vaults and pillars so that subsequentaddresses are organized by pillar of the file data segments of a dataobject that have EC data slices with the same slice identifier and henceare typically stored at the same DS storage unit (e.g., slices having afirst pillar identifier are stored in DS storage unit A of DSN memory22). The output of the access to the virtual DSN address to physicallocation table 142 is the DSN memory identifier 154 and DS storage unitidentifiers 156. A source name, data segment header and/or slice namemay include the DSN memory identifier 154 and/or DS storage unitidentifiers 156.

The slice names may be used as the virtual index to the memory system ofeach DS storage unit 36 of a particular DS memory 22 to gain access tothe physical location of the EC data slices. In this instance, the DSstorage unit 36 of the DS memory 22 maintains a local table correlatingslice names (virtual DSN address) to the addresses of the physical mediainternal to the DS storage unit 36. For example, user number 1 has avault identified operational parameter of four pillars and pillar 0 ismapped to DS storage unit A of DSN memory 22, pillar 1 is mapped to DSstorage unit C of DSN memory 22, pillar 2 is mapped to DS storage unit Dof DSN memory 22, and pillar 3 is mapped to DS storage unit F of DSNmemory 22.

FIG. 7 is a schematic block diagram of an embodiment of certainparameters associated with a user vault 200. The parameters illustratedin FIG. 7 may be stored in the user vault 200 or other resource, such asa user file, parameter database, file/block index, URL, etc. that isimplemented in the managing unit 18, DS processing unit 16 or a DSprocessing module 34.

The operational parameters 202 include vault identifier field 204, vaultgeneration field 206, error encoding scheme field 212, slice number Xfield 214 (e.g., number of pillars n for the user vault) and thresholdnumber T field 216. The operational parameters 202 also include a fixedsegment number Y field 208 and/or a Fixed Segment Size Field 210. In anembodiment, the user vault 200 is configured with a Fixed Segment SizeField 210. Since the data segment size is fixed, the number Y of datasegments varies depending on the size of a data object. Padding orstuffing bytes may be added to one or more data segments to obtain thefixed segment size. In another embodiment, the user vault 200 isconfigured with a fixed segment number Y field 208. Since the number ofdata segments is fixed, the size of the data segments varies dependingon the size of a data object. In another embodiment, a user vault 160may have varying configurations for different data objects. For example,some data objects are partitioned into a varying number Y of datasegments with a fixed segment size while other data objects arepartitioned into a fixed number Y of data segments with varying size.The operational parameters 202 associated with a user vault 200 shown inFIG. 7 may also include other fields not described herein.

The user vault 200, or other resource, such as a user file, parameterdatabase, file/block index, URL, etc., also stores Files 220 a-n withdata segment information specific to data objects, including datasegment size field 224, data segment number Y field 226, segmentrevision field 228, data object size field 230 and segmentation strategyfield 232. In an example for a data object 40 having 4,194,304 bytes,when the Fixed Segment Size Field 210 specifies partitioning a dataobject 40 into fixed byte size segments of 4,096 bytes, then the datasegment number field 224 specifies 1,024 data segments for the dataobject. Since the segment size is fixed, the File 220 for the dataobject may not include the data segment size field 226. In anotherexample for a data object 40 having 4,194,304 bytes, when the FixedSegment Number Y Field 208 specifies Y=131,072, then the data segmentsize field 224 for the data object specifies 32 bytes. Since the segmentnumber Y is fixed, the File 220 for the data object may not include thedata segment number field 226. The segment revision field 228 stores arevision number for the data object. The data object size field 230stores a size of the data object, e.g. a number of bytes in the dataobject. The segmentation strategy field 232 stores whether the dataobject has a fixed number of data segments or a fixed segment size.

In an embodiment, one or more of the parameters in the File 220 may beincluded in the source name 35 for a data object or included in slicenames 37 for a data segment or included in a data segment name orheader. Other information not shown in FIG. 7, such as data object name,source name, file id, vault id, etc. associated with a data object maybe stored as well in the user vault 200.

In an embodiment, when a stored data object needs to be modified, a userdevice 12 and/or 14 sends a modification request to a DS processingmodule 34, which authenticates the request. When the request isauthenticated, the DS processing 34 reconstructs each of the pluralityof data segments for the data object. It sends a read message to each ofthe DS storage units 36 storing at least a threshold number T of dataslices for each of the plurality of data segments. The data slices arereceived for the plurality of data segments and the data segments arerebuilt therefrom. The DS processing 34 then reconstructs the dataobject from the plurality of rebuilt data segments and modifies the dataobject as per the modification request. However, this process ofmodification requires that each of the plurality of data segments isrebuilt and that in turn requires retrieving data slices for each datasegment.

FIG. 8 is a flowchart illustrating another embodiment of a method 250for modifying a stored data object 40 in the distributed storage networkin accordance with the invention. In this embodiment, the DS processingmodule 34 only retrieves the data segments of the data object thatrequire modification in response to the modification request. Thisembodiment improves response time and security by retrieving andrebuilding only a portion of the data object rather than the entire dataobject. In addition, only the rebuilt portion of the data object needsto be processed and stored after modification.

In operation, the DS processing module 34 identifies at least one of aplurality of data segments of a data object requiring modification instep 252. The DS processing module 34 reconstructs the identified datasegment from at least a threshold number T of the plurality of encodeddata slices for the identified data segment to produce a reconstructeddata segment in step 254. The DS processing module 34 then modifies thereconstructed data segment to generate a modified data segment in step256. The modifications may include additions, deletions or revisions toone or more bytes of the reconstructed data segment. In an embodiment,the DS processing module 34 then generates a plurality of rebuiltencoded data slices from the modified data segment using the errorencoding dispersal function and transmits the rebuilt encoded dataslices for storage.

FIG. 9 is a logic flow diagram of an embodiment of a method 280 foridentifying at least one of a plurality of data segments of a dataobject requiring modification. In an embodiment, in step 282, the DSprocessing module 34 receives a request to modify a portion of a dataobject 40 from one of a user device 12-14, DS processing unit 16, DSmanaging unit 18, storage integrity processing unit 20, DSN memory or aDS unit 36. In an embodiment, the modification request includes, interalia, a user ID field, object name field and a position indicator andrequested modifications. The position indicator includes anidentification of or pointer to one or more bytes of the data object 40for modification. For example, the position indicator may indicate byte125,348 out of 2,465,820 bytes in the data object 40.

The DS processing module 34 determines a segment size of the pluralityof data segments of the data object in step 284. In an embodiment, theDS processing module 34 accesses the user vault 200 to determine a datasegment size for the data object 40. When the operational parameters 202for a user vault 200 indicate that data segments must have a fixed size,then the DS processing module 30 may only need to access the FixedSegment Size Field 210 for the user vault 200. When the user vaultindicates data objects have a fixed segment number Y with varying sizes,then the DS Processing Module 34 may also need to access the datasegment size field 224 for the data object in one of the Files 220 a-n.In an embodiment, the data segments of a data object may have varyingsizes. For example, a first data segment includes 100,000 bytes and asecond data segment includes 80,000 bytes, etc. In such a case, the DSprocessing module 34 must determine one or more sizes for the pluralityof the data segments of the data object from the user vault 200. Inanother embodiment, the modification request may include a data segmentsize for the plurality of data segments for the data object.

The DS processing module 34 in step 286 then identifies one or more datasegments of the data object 40 requiring modification based on theposition indicator and the data segment sizes. For example, when thedata segment size is 100,000 bytes and the position indicator denotesbyte 125,348, the DS processing module 34 identifies the second datasegment of the data object 40 for modification because it includes thebyte 125,348 that requires modification. Once the data segment isidentified, the DS processing module 34 then determines a virtual DSNaddress of the encoded data slices for the identified data segment fromthe user virtual memory 152, source name, data segment header, etc. andretrieves at least a threshold number T of the encoded data slices forthe identified data segment from a DSN memory 22 based on the virtualDSN address to physical location table 142. The DS processing modulethen reconstructs the identified data segment to generate areconstructed data segment in step 288.

FIG. 10 is a schematic block diagram of an embodiment of a modificationrequest 300. The modification request 300 includes a packet header 302having for example, a user ID field 306, object name field 308,transaction type field 310, source name field 310 and payload lengthfield 314. The transaction type field 310 identifies the packet as amodification request. In operation, the DS processing module 34processes the source name field 312 information in the modificationrequest 300 to determine a vault identifier and to index the user vault200. When a source name is not available, the DS processing module 34utilizes the user ID and object name to access the user virtual memory152 to determine a vault identifier. The DS processing module thendetermines a virtual DSN address 148 for the data object from uservirtual memory 152.

The payload 304 of the modification request 300 includes one or moreposition indicator fields 316 a-n and corresponding one or moremodification fields 318 a-n. The position indicator field 316 includesan identification of or pointer to one or more bytes of the data object40 for modification in accordance with the corresponding modificationfield 318. The modification field 318 may include instructions foradditions, deletions or revisions.

FIG. 11 is a logic flow diagram of an embodiment of a method 340 formodifying the reconstructed data segment. In step 342, the DS processingmodule 34 modifies the reconstructed data segment in accordance with themodification request to generate a modified data segment. Themodification may include changing one or more bytes of the data segmentor deleting or adding one or more bytes. In an embodiment, the DSprocessing module 34 identifies and modifies more than one data segmentwhen one or more bytes to be modified are included within more than onedata segment. In step 344, the data segment size field 224 in the uservault 200 or in a source name or packet header for the data segment ismodified to update any changes to the data segment size. The segmentrevision field 228 in the user vault 200 or in a source name or packetheader for the data segment is also updated in step 346.

FIG. 12 is a logic flow diagram of another embodiment of a method 350for modifying the reconstructed data segment. When modifications resultin deleting or adding one or more bytes to a data segment or otherwisechanging the data segment size in step 352, the DS processing module 34in step 354 determines whether the modified data segment size needs tobe revised in step 354. For example, the operational parameters 202 forthe user vault 200 may require a fixed segment size or each of theplurality of data segments for the data object may each need to have asame data segment size, etc. When the segment size of the modified datasegment does not need to be modified, the process continues to step 364in which a data segment size field 224 is updated and then to step 366in which a revision field is updated.

When the modified data segment size needs to be revised in step 354, theDS processing module 34 determines whether it needs to increase ordecrease the size of the modified data segment in step 356. To increasethe size of the modified data segment in step 358, the DS processingmodule includes stuffing or padding bytes to the data segment. When themodified data segment size needs to decrease, the DS processing module34 divides the modified data segment to generate at least two dividedmodified data segments in step 360. The DS processing module 34 may thenadd stuffing or padding bytes to one or more of the divided datasegments to reach the desired segment size, e.g., the fixed segment sizeor data segment size of the other plurality of data segments for thedata object, etc. In step 362, the DS processing module updates the DataSegment Number Y field 226 for the data object 40 in the user vault 200.The DS processing module 30 also updates the data segment size field 224in step 364, and the revision field 228 for the data segment is updatedto indicate a new number of total data object bytes in step 366.

When modification is complete on a modified data segment (including anydivided modified data segments), the DS processing module 34 encodes themodified data segment and slices it using an error encoding dispersalfunction based on the operational parameters in the user vault 200 toproduce a number X of rebuilt encoded data slices. The DS processingmodule 34 generates a write request message to transmit the rebuiltencoded data slices to a DSN memory 22 for storage in a plurality of DSunits 36.

FIG. 13 illustrates a schematic block diagram of an embodiment of awrite request message 380 having a protocol header 382 and a payloadwith one or more slice packets 384 a-n. A slice packet 384 includes aslice name field 388, a slice revision field 390, a slice length field392, and a slice payload field 394. Each of the fields of a slice packetcorresponds to the same encoded data slice. The slice name field 388contains the slice name of the rebuilt encoded data slice while theslice revision field 390 contains a slice revision of the rebuiltencoded data slice. Since the rebuilt encoded data slice has beenmodified, the slice revision field is updated to reflect a new version.The slice length field 392 includes a slice length value representing anumber of bytes of the rebuilt encoded data slice. The slice payloadfield 394 includes the bytes of the rebuilt encoded data slice.

FIG. 14 illustrates a logic flow diagram of an embodiment of a method400 for generating and storing rebuilt encoded data slices from amodified data segment. As discussed, the DS processing module 34 encodesthe modified data segment and slices it using an error encodingdispersal function based on the operational parameters in the user vault200 to produce a plurality of rebuilt encoded data slices in step 402.The DS processing module 34 generates a slice packet 384 for each of theplurality of rebuilt encoded data slices in step 404 and updates theslice name field 388, slice revision field 390, slice length field 392and slice payload field 394 for each of the slice packets 384 in step406. The DS processing module 34 generates the protocol header andpayload with the slice packets 384 to produce a write request message instep 408 and transmits the write request message to one or more DSNmemories 22 for storage of the rebuilt encoded data slices in aplurality of storage units 36 in step 410. The DS processing module 34may update the virtual DSN address to physical location table 142 whenthere are any changes to the addressing of the rebuilt encoded dataslices.

FIG. 15 is a schematic block diagram of an embodiment of a data segmentheader 412 for a data segment 42. The data segment 412 includes a dataobject size field 230, a fixed segment size field 210, segmentationstrategy field 232 and segment revision field 228. The data segmentheader 412 may be included with a first of the plurality of datasegments of the data object or included on each of the data segments.Additional or alternate fields may also be included in the data segmentheader 412.

FIG. 16 is a flowchart illustrating another embodiment of a method 430for modifying a data object stored in a DSN memory 22. In an embodiment,the DS processing module 34 replaces an identified data segment withoutreconstructing it. For example, when a modification request includesmodifications that would replace data for an entire identified datasegment, then the identified data segment does not need to bereconstructed. Instead, a replacement data segment is generated and theidentified data segment is replaced or overwritten by the replacementdata segment.

In an embodiment, in step 432, the DS processing module 34 receives amodification request 300 to modify a data object 40 from one of a userdevice 12-14, DS processing unit 16, DS managing unit 18, storageintegrity processing unit 20, DSN memory or a DS unit 36. The DSprocessing module 34 determines a segment size of the plurality of datasegments of the data object in step 434. The DS processing module 34 instep 436 then identifies one or more data segments of the data object 40requiring modification based on the position indicator and the datasegment size of the plurality of data segments to generate an identifieddata segment. In step 438, the DS processing module 34 determineswhether the identified data segment is replaced. For example, therequested modifications may include new data or revised data for theentire identified data segment. If so, a replacement data segment isgenerated from the data in the modification request in step 440. Thereplacement data segment is then processed based on an error encodingdispersal function to generate a plurality of replacement data slices instep 440. A segment revision 228 is updated for the replacement datasegment in the user vault 200 or the data segment header 412. The slicerevision field 390 for the plurality of replacement data slices is alsorevised in step 442 though the replacement data slices will retain thesame slice names as the stored data slices of the identified datasegment. The DS processing module 34 then transmits the plurality ofreplacement data slices to the DSN memory 22 in step 446. The pluralityof data slices from the identified data segment are deleted andoverwritten or replaced by the plurality of replacement data slices ofthe replacement data segment.

When a data segment is not replaced in step 438, the identified datasegment is reconstructed in step 448 and modified to generate a modifieddata segment in step 450 as described herein.

In an embodiment, the DS processing module 34 identifies andreconstructs one or more data segments of a data object that requiremodification in response to a modification request. Response time andsecurity are improved because only a portion of the data object isprocessed for modification.

FIG. 17 is a logic flow diagram of an embodiment of a method 500 forupdating software operating or stored on system elements of thedistributed storage network. The system elements include devices ormodules thereof operating in the distributed storage network, such asinter alia, user device 12, 14, DS processing unit 16, computing core26, interfaces 30, 32, 38, DS managing unit 18, storage integrity unit20, DSN memory 22, and DS unit 36. DS managing unit 18 determineswhether a software update for one or more of the system elements isavailable in step 502. A software update includes updates, fixes,patches, new applications, new versions of existing applications, orother modifications or additions to the software operating or stored ona system element. For example, the DS managing unit 18 determineswhether a software update has been received over a network connectionfrom another network node or a memory device (e.g., a disc, a USB memorystick, etc.) or whether a software update is available for download,such as from a network web server or other resource.

When available in step 504, the DS managing unit 18 downloads orreceives the software update and stores the software update in arepository memory. When the DS managing unit 18 determines that softwareupdates are not currently available in step 504, the DS managing unit 18continues to determine whether a software update for one or more of thesystem elements is available.

In step 506, the DS managing unit 18 determines whether any of thesystem elements require the software update. For example, the DSmanaging unit 18 may maintain a list of system elements and versions ofsoftware operating thereon. The DS managing unit 18 then compares theversion of the software update to the version listed for the systemelements. In another example, the DS managing unit 18 may determinewhether the software update is optional, recommended or required. Forexample, the system elements may have a current version, not utilizingthe applicable software, etc. When the DS managing unit 18 determinesthat the system elements do not currently require the software update instep 508, the process continues back to step 502.

When the DS managing unit 18 determines that the system elements do notcurrently require the software update in step 508, the DS managing unitidentifies a system element to update in step 510 based on one or morefactors. For example, the DS managing unit 18 may determine to installthe software update first when it requires the update. In anotherexample, a factor includes maintaining availability of at least athreshold number T of a storage set of DS units 36. A storage set is theplurality of DS units 36 that store pillars for a user vault. Since theupdate process make take minutes or even hours, a limit on the number ofDS units 36 that are unavailable due to a software update process maystill enable a data object to be retrieved that is stored in the storageset. For example, at least a threshold number T of DS units 36 in astorage set need to be available to retrieve a data object. In anotherexample, the DS managing unit 18 determines that at least a thresholdnumber T plus a safety factor (e.g., one or two) of DS units 36 areavailable to enable the retrieval of data objects. In other words, theDS managing unit 18 will only update a number of DS units in the samestorage set equal to [width n number of pillars−read threshold numberT−safety factor]. For example, the DS managing unit 18 may concurrentlyupdate 4 DS units when n=16, read threshold T=10, and the safetyfactor=2.

The DS managing unit sends an activate process update client (PUC)message to the identified system element to initiate the software updateprocess for that system element in step 512. If additional systemelements require the software update, the process continues to step 510to identify a next system element to update.

FIG. 18 is a logic flow diagram of an embodiment of a method 520 forupdating software operating or stored on a system element of thedistributed storage network. In an embodiment, a system element installsa software update. The system element may have previously installed aprocess update client program which may be utilized to install andactivate the software update. In step 522, the system element determineswhether it has received an activate process update client (PUC) messagewhere the determination is based on comparing incoming commands from thenetwork to that of the PUC command. When the system element determinesthat it has not received an activate process update client (PUC) messagein step 524, the process continues to step 522 to continue to scan for aPUC command. When the system element has received a PUC command, thesystem element activates the PUC and changes its status to unavailablein step 526. The system element may complete critical steps in progressprior to changing the status and stop accepting new tasks.

The system element may suspend active processes in step 528 and savenext steps in such suspended processes to execute later. The systemelement determines a location of the software update based on a localregistry that may contain the network uniform resource identifier (URI)of the software repository and/or the URI of the DS managing unit 18 orother location. The system element accesses the URI and downloads thesoftware update in step 530. The system element installs the softwareupdate in step 532. The software update should be backwards compatiblewith previous software versions to enable interactions with other systemelements that have not installed the software update. The system elementmay activate one or more software installation and activation scriptsincluded with the software update to perform an initialization in step534. When complete, the system element changes its status fromunavailable to available, and it may complete earlier suspended tasks.

As may be used herein, the term(s) “coupled to” and/or “coupling” and/orincludes direct coupling between items and/or indirect coupling betweenitems via an intervening item (e.g., an item includes, but is notlimited to, a component, an element, a circuit, and/or a module). As mayfurther be used herein, inferred coupling (i.e., where one element iscoupled to another element by inference) includes direct and indirectcoupling between two items in the same manner as “coupled to”. As mayeven further be used herein, the term “operable to” indicates that anitem includes one or more of power connections, input(s), output(s),etc., to perform one or more its corresponding functions and may furtherinclude inferred coupling to one or more other items. As may stillfurther be used herein, the term “associated with”, includes directand/or indirect coupling of separate items and/or one item beingembedded within another item.

The present invention has also been described above with the aid ofmethod steps illustrating the performance of specified functions andrelationships thereof. The boundaries and sequence of these functionalbuilding blocks and method steps have been arbitrarily defined hereinfor convenience of description. Alternate boundaries and sequences canbe defined so long as the specified functions and relationships areappropriately performed. Any such alternate boundaries or sequences arethus within the scope and spirit of the claimed invention.

The present invention has been described above with the aid offunctional building blocks illustrating the performance of certainsignificant functions. The boundaries of these functional buildingblocks have been arbitrarily defined for convenience of description.Alternate boundaries could be defined as long as the certain significantfunctions are appropriately performed. Similarly, flow diagram blocksmay also have been arbitrarily defined herein to illustrate certainsignificant functionality. To the extent used, the flow diagram blockboundaries and sequence could have been defined otherwise and stillperform the certain significant functionality. Such alternatedefinitions of both functional building blocks and flow diagram blocksand sequences are thus within the scope and spirit of the claimedinvention. One of average skill in the art will also recognize that thefunctional building blocks, and other illustrative blocks, modules andcomponents herein, can be implemented as illustrated or by discretecomponents, application specific integrated circuits, processorsexecuting appropriate software and the like or any combination thereof.

What is claimed is:
 1. A method, comprises: processing a modificationrequest to modify a data object, wherein the modification requestincludes an identification of one or more bytes of a data object formodification; identifying a portion of the data object that includes theone or more bytes of the data object for modification; reconstructingthe identified portion of the data object from a plurality of encodeddata slices to produce a reconstructed portion of the data object; andmodifying the one or more bytes of the data object in the reconstructedportion of the data segment in response to the modification request. 2.The method of claim 1, wherein the portion of the data object includes aplurality of data segments.
 3. The method of claim 2, wherein each ofthe plurality of data segments is stored using an X number of theplurality of encoded data slices.
 4. The method of claim 3, wherein eachof the plurality of data segments is reconstructed from at least anumber T of the X number of the plurality of encoded data slices toproduce a plurality of reconstructed data segments of the data object.5. The method of claim 1, wherein the portion of the data objectincludes one data segment of the data object, wherein the data segmentis stored using the plurality of encoded data slices generated using onan error encoding dispersal function.
 6. The method of claim 5, whereinthe data segments is reconstructed from at least a number T of the Xnumber of the plurality of encoded data slices to produce areconstructed data segment of the data object.
 7. The method of claim 1,wherein the modification request includes a requested modification tothe data object, wherein the requested modification includes at leastone of: an addition, a deletion or revision to one or more bytes of thedata object.
 8. The method of claim 1, wherein identifying a portion ofthe data object comprises: determining a size of the plurality of datasegments of the data object from a segment size field; and identifyingone or more of the plurality of data segments requiring modification inresponse to the position indicator and the size of the plurality of datasegments of the data object.
 9. The method of claim 1, furthercomprising: generating a plurality of rebuilt encoded data slices fromthe modified reconstructed portion of the data segment using an errorencoding dispersal function; and transmitting the plurality of rebuiltencoded data slices for storage in a plurality of storage units.
 10. Themethod of claim 9, further comprising: modifying a revision field forthe plurality of rebuilt encoded data slices.
 11. A device, comprises: anetwork interface for interfacing with a plurality of storage units in astorage network; and at least one processing module operable to: processa request to modify a data object, wherein the data object is stored asa plurality of data segments; identify at least one of the plurality ofdata segments of the data object requiring modification, wherein the atleast one identified data segment is stored as a plurality of encodeddata slices; reconstruct the at least one identified data segment fromat least a number T of the plurality of encoded data slices to produceat least one reconstructed data segment; modify the at least onereconstructed data segment based on the request to generate at least onemodified data segment.
 12. The device of claim 11, wherein theprocessing module is operable to: generate a plurality of rebuiltencoded data slices from the at least one modified data segment using anerror encoding dispersal function; and transmit the plurality of rebuiltencoded data slices for storage in the plurality of storage units. 13.The device of claim 12, wherein the request includes a requestedmodification to the data object and a position indicator that points toone or more bytes of the data object for modification.
 14. The device ofclaim 13, wherein the processing module is operable to: identify atleast one of the plurality of data segments requiring modification inresponse to the position indicator and size of the plurality of datasegments of the data object.
 15. A device, comprising: at least oneprocessing module operable to: identify a first one of a plurality ofdata segments of a data object requiring modification in response to amodification request, wherein the first identified one of the pluralityof data segments is stored as a first plurality of encoded data slicesin one or more storage units; generate a first replacement data segmentbased on one or more modifications in the modification request; andgenerate a first plurality of replacement encoded data slices from thefirst replacement data segment based on an error encoding dispersalfunction; and transmit the first plurality of replacement encoded dataslices to replace the first plurality of encoded data slices of thefirst identified one of the plurality of data segments in the one ormore storage units.
 16. The device of claim 15, wherein the at least oneprocessing module is further operable to: identify a second one of theplurality of data segments of the data object requiring modification inresponse to the modification request, wherein the second identified oneof the plurality of data segments is stored as a second plurality ofencoded data slices in one or more storage units; generate a secondreplacement data segment based on the one or more modifications in themodification request; and generate a second plurality of replacementencoded data slices from the second replacement data segment based onthe error encoding dispersal function; and transmit the second pluralityof replacement encoded data slices to replace the second plurality ofencoded data slices of the second identified one of the plurality ofdata segments in the one or more storage units.
 17. The device of claim15, wherein the modification request includes a position indicator thatindicates one or more bytes of the data object for modification.
 18. Thedevice of claim 17, wherein the processing module is operable toidentify the first and second one of the plurality of data segments ofthe data object requiring modification in response to the modificationrequest by: determining a size of the plurality of data segments of thedata object from a segment size field; and identifying the first andsecond one of the plurality of data segments requiring modificationusing the position indicator as including the one or more bytes of thedata object for modification.
 19. The device of claim 15, wherein themodification request includes a first position indicator that indicatesa first one or more bytes of the data object for modification and asecond position indicator that indicates a second one or more bytes ofthe data object for modification.
 20. The device of claim 19, whereinthe processing module is operable to identify the first and second oneof the plurality of data segments of the data object requiringmodification in response to the modification request by: determining asize of the plurality of data segments of the data object from a segmentsize field; identifying the first one of the plurality of data segmentsrequiring modification using the first position indicator as includingthe first one or more bytes of the data object for modification; andidentifying the second one of the plurality of data segments requiringmodification using the second position indicator as including the secondone or more bytes of the data object for modification.